diff --git a/app/controllers/api/account.php b/app/controllers/api/account.php index 61b0e27be..37da2a205 100644 --- a/app/controllers/api/account.php +++ b/app/controllers/api/account.php @@ -1272,16 +1272,16 @@ App::delete('/v1/account/sessions/:sessionId') ->setParam('resource', '/user/'.$user->getId()) ; - if (!Config::getParam('domainVerification')) { - $response - ->addHeader('X-Fallback-Cookies', \json_encode([])) - ; - } - $session->setAttribute('current', false); - + if ($session->getAttribute('secret') == Auth::hash(Auth::$secret)) { // If current session delete the cookies too $session->setAttribute('current', true); + + if (!Config::getParam('domainVerification')) { + $response + ->addHeader('X-Fallback-Cookies', \json_encode([])) + ; + } $response ->addCookie(Auth::$cookieName.'_legacy', '', \time() - 3600, '/', Config::getParam('cookieDomain'), ('https' == $protocol), true, null)